Britive Secrets Manager API

openapi: 3.2.0
info:
  title: Secret Manager Secrets Manager API
  version: v1
  description: API documentation for Secret Manager, Policy Administration, Notifications, Approval service, etc.
servers:
- url: https://{tenantURL}
  description: The primary server
  variables:
    tenantURL:
      default: test.britive-app.com
      description: The host of the server
security:
- bearerAuth: []
tags:
- name: Secrets Manager
paths:
  /api/v1/secretmanager/keys/rotate:
    post:
      tags:
      - Secrets Manager
      summary: Rotate vault encryption key
      description: This operation will rotate key for tenant.
      operationId: rotateKey
      responses:
        '202':
          description: Accepted
  /api/v1/secretmanager/pwdpolicies:
    post:
      tags:
      - Secrets Manager
      summary: Create password policy for alphanumeric password
      operationId: createPasswordPolicy
      parameters:
      - name: action
        in: query
        description: Action
        schema:
          type: string
        example: validatePasswordOrPin
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyDTO'
            example:
              name: DBPasswordPolicy
              description: Password Policy
              passwordType: alphanumeric
              minPasswordLength: '8'
              hasUpperCaseChars: 'false'
              hasLowerCaseChars: 'true'
              hasNumbers: 'true'
              hasSpecialChars: 'true'
              allowedSpecialChars: '@#$%('
        required: false
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get a list of password policies
      operationId: getPasswordPolicies
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%pwdPolicy
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/pwdpolicies/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete a specified password policy
      operationId: deletePasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get specified password policy's details
      operationId: getPasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: action
        in: query
        description: Action
        schema:
          type: string
        example: generatePasswordOrPin
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update password policy details
      operationId: updatePasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyDTO'
            example:
              name: DBPasswordPolicy
              description: Password Policy Updated
              passwordType: alphanumeric
              minPasswordLength: '8'
              hasUpperCaseChars: 'false'
              hasLowerCaseChars: 'true'
              hasNumbers: 'false'
              hasSpecialChars: 'true'
              allowedSpecialChars: '@#$%('
              pinLength: '9'
        required: false
      responses:
        '204':
          description: No content
  /api/v1/secretmanager/resourceContainers:
    get:
      tags:
      - Secrets Manager
      summary: Get IDs of all container resources
      operationId: getResourceContainers
      parameters:
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/secret-templates/static:
    post:
      tags:
      - Secrets Manager
      summary: Create StaticSecretTemplate for static secret
      operationId: createSecretParam
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StaticSecretTemplateDTO'
            example:
              secretType: AWSServiceSecretTes
              description: description
              rotationInterval: '30'
              parameters:
              - name: url
                description: DB Hostname
                mask: 'false'
                required: true
                type: singleLine
                metadata: 'true'
              - name: username
                description: DB Username
                mask: 'true'
                required: false
                type: multiLine
                metadata: 'false'
              - name: password
                description: DB Password
                mask: 'true'
                required: true
                type: password
                metadata: 'false'
              - name: test file
                description: test file upload
                mask: 'false'
                required: true
                type: fileUpload
                metadata: 'false'
              passwordPolicyId: 81910feb-92d3-4583-b9a9-dd3476381a6b
        required: false
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get static secret template
      operationId: getSecretParams
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20secretType
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/secret-templates/static/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete static secret template
      operationId: deleteSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get a specified static secret template
      operationId: getSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update static secret template parameteres
      operationId: updateSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StaticSecretTemplateDTO'
        required: false
      responses:
        '204':
          description: No content
  /api/v1/secretmanager/vault:
    post:
      tags:
      - Secrets Manager
      summary: Create a vault for the Secrets Manager
      description: This operation should be called only by administrator and only once per tenant.
      operationId: initializeVault
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VaultDTO'
            example:
              name: my-vault
              description: Production secrets vault
              rotationTime: '90'
              encryptionAlgorithm: AES
              defaultNotificationMediumId: 01d4b73e-46b3-4347-842d-6b556dc7f9b2
              keyRotationScheduleTime: 04:00
              staticExpiryReminderFrequency: Daily
              staticExpiryReminderTime: 04:00
              dynamicRotationScheduleTime: 04:30
              dynamicRotationIntervalHours: '24'
              recipients:
                userIds:
                - g1bfrv2idml7sxfb5q70
                tags: []
                channelIds: null
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
        '400':
          description: 'Bad request. Returned for the following violations:

            - `SM-0174` — `keyRotationScheduleTime` and `dynamicRotationScheduleTime` are less than 30 minutes apart. Both fields are validated against their resolved values; omitted fields are replaced by their defaults (`04:00` and `04:30`) before the check runs.

            - `SM-0175` — `staticExpiryReminderFrequency` is not one of `Daily`, `Weekly`, or `Off`.

            - `SM-0176` — `staticExpiryReminderDay` is missing or not in range 1–7 when `staticExpiryReminderFrequency` is `Weekly`.

            - `SM-0177` — `dynamicRotationIntervalHours` is not one of `4`, `8`, `12`, or `24`.

            - `SM-0178` — `keyRotationScheduleTime`, `staticExpiryReminderTime`, or `dynamicRotationScheduleTime` is not in `HH:mm` format. Message: `Invalid schedule time format. Expected HH:mm (e.g. 14:30).`

            '
    get:
      tags:
      - Secrets Manager
      summary: Get details of current active vault
      operationId: getVaults
      parameters:
      - name: searchName
        in: query
        schema:
          type: string
      - name: getmetadata
        in: query
        description: true/false
        schema:
          type: boolean
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/secrets:
    get:
      tags:
      - Secrets Manager
      summary: Get secret in vault hierarchy
      operationId: getResource
      parameters:
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/secrets/{id}:
    get:
      tags:
      - Secrets Manager
      summary: Get a specified secret details
      operationId: getResourceById
      parameters:
      - name: id
        in: path
        description: resource Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete a specified vault
      operationId: deleteVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get vault details
      operationId: getVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update a specified vault's details
      operationId: updateVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VaultDTO'
            example:
              name: vault1
              description: vault description1
              rotationTime: '3'
              maxSecretRotationInterval: '60'
              defaultNotificationMediumId: 01d4b73e-46b3-4347-842d-6b556dc7f9b2
              keyRotationScheduleTime: 02:00
              staticExpiryReminderFrequency: Weekly
              staticExpiryReminderTime: 09:00
              staticExpiryReminderDay: '1'
              dynamicRotationScheduleTime: 03:00
              dynamicRotationIntervalHours: '24'
              recipients:
                userIds:
                - g1bfrv2idml7sxfb5q70
                tags: []
                channelIds: null
        required: false
      responses:
        '204':
          description: No content
        '400':
          description: 'Bad request. Returned for the following violations:

            - `SM-0174` — `keyRotationScheduleTime` and `dynamicRotationScheduleTime` are less than 30 minutes apart. Both fields are validated against each other; changing either one triggers the check.

            - `SM-0175` — `staticExpiryReminderFrequency` is not one of `Daily`, `Weekly`, or `Off`.

            - `SM-0176` — `staticExpiryReminderDay` is missing or not in range 1–7 when `staticExpiryReminderFrequency` is `Weekly`.

            - `SM-0177` — `dynamicRotationIntervalHours` is not one of `4`, `8`, `12`, or `24`.

            - `SM-0178` — `keyRotationScheduleTime`, `staticExpiryReminderTime`, or `dynamicRotationScheduleTime` is not in `HH:mm` format. Message: `Invalid schedule time format. Expected HH:mm (e.g. 14:30).`

            '
  /api/v1/secretmanager/vault/{vaultId}/accesssecrets:
    post:
      tags:
      - Secrets Manager
      summary: Access secret at a given path
      description: In case approval is required to access a secret then it sends an approval request with justification. Till the time the request is not approved, it sends the current status of the request in response. For example-"Pending Approval", "Approval Needed", "Access Denied".
      operationId: getSecretDataPost
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get access secrets
      operationId: getSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/downloadfile:
    get:
      tags:
      - Secrets Manager
      summary: Download secret file content
      operationId: downloadFile
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/octet-stream:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secret-metadata:
    get:
      tags:
      - Secrets Manager
      summary: Get secret metadata details
      operationId: getSecretMetaData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secrets:
    post:
      tags:
      - Secrets Manager
      summary: Create a node/secret
      operationId: createSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret/Node parent path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretDataDTO'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
        '400':
          description: 'Bad request. Returned for the following rotation interval violations when `rotationIntervalUnit` is `HOURS`:

            - `SM-0178` — `rotationInterval` in hours is not a valid multiple of the vault''s `dynamicRotationIntervalHours`. Message: `Secret rotation interval in hours must be a multiple of the vault''s dynamic rotation interval ({n} hours). Valid options: {list}.`

            - `SM-0179` — Hourly rotation is not allowed when the vault''s `dynamicRotationIntervalHours` is `24`. Message: `Hourly rotation interval is not allowed when the vault''s dynamic rotation frequency is set to 24 hours. Please use a days-based rotation interval.`

            - `SM-0180` — Hourly rotation interval is not allowed for static secrets (`secretNature: static`). Message: `Hourly rotation interval is not allowed for static secrets. Please use a days-based rotation interval.`

            '
    delete:
      tags:
      - Secrets Manager
      summary: Delete node/secret
      operationId: deleteSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get Nodes/Secrets on one level under given parent
      operationId: getOneLevelSecretData
      parameters:
      - name: type
        in: query
        description: node or secret
        schema:
          type: string
        example: node
      - name: pageToken
        in: query
        description: Page Token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      - name: getmetadata
        in: query
        description: true or false
        schema:
          type: boolean
        example: 'true'
      - name: recursiveSecrets
        in: query
        description: boolean value
        schema:
          type: string
          default: 'false'
        example: 'true'
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20secretType
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update / Move Secret
      description: 'Updates a secret in the vault hierarchy. This endpoint handles three distinct operations — field-value update, rename, and move — determined by which fields are present in the request body. Only one operation should be performed per request.


        > **Note:** Only secrets (`entityType: secret`) can be moved. Folder nodes (`entityType: node`) cannot be moved using this endpoint.


        ---


        ### Update Field Values

        To update the credential data of a secret, include a `value` map in the request body containing the field names and their new values as defined by the secret''s template.


        For **dual-account secrets**, use `secondaryValue` instead of `value` to update the secondary credential fields. Attempting to update `value` (primary fields) on a dual-account secret is not allowed and returns `400 "Updating secret primary field values not allowed for dual account"`. Conversely, providing `secondaryValue` when dual account is not enabled on the secret returns `400 "Can not update secondary secret field values as dual account is not enabled"`.


        **Versioning and rotation behaviour** is controlled by two optional query parameters:

        - `saveAsVersion=true` — snapshots the current credential values as a new immutable version before applying the update. This allows the previous credential to be retrieved later via the versions endpoint. Defaults to `false`.

        - `syncToTarget=true` — after saving, pushes the new credential to all mapped rotation target accounts via the Britive Broker. When `syncToTarget` is omitted or set to `false`, the target resources are not updated automatically and must be rotated separately.


        For **dual-account secrets**, a successful `syncToTarget` sync triggers the Primary/Secondary account swap, alternating which account holds the active credential to ensure zero downtime during rotation.


        ---


        ### Rename

        To rename a secret, include the `name` field in the request body with the new name. The secret stays in its current folder; only its name changes.


        - The new name must be unique within the same parent folder.

        - Rename and move cannot be performed in the same request. If both `name` and `path` are changed simultaneously, the request is rejected with `400 "Not allowed to rename and move secret simultaneously."`


        ---


        ### Move (Secrets Only)

        To move a secret to a different folder, include the `path` field in the request body with the full destination vault-relative path including the secret name. The `path` query parameter identifies the secret''s current location; the `path` body field specifies where it should be moved to.


        For example, to move `my-secret` from `/folder1/subfolder1/my-secret` to `/folder1/my-secret`, send:

        ```

        PATCH /vault/{vaultId}/secrets?path=/folder1/subfolder1/my-secret

        { "path": "/folder1/my-secret" }

        ```


        **Path format rules** — violation returns `400 "Invalid secret path : {path}"`:

        - Must start with `/`

        - Must not contain `//` (double slashes)

        - Must not end with `/` (trailing slash)

        - The basename (last path segment) must equal the existing secret name — renaming and moving in the same request is not supported


        **Required permissions on the destination folder** — violation returns `403 "Move not allowed due to missing permissions : {folder}"`:

        - `sm.node.create` — must be non-null and not Deny

        - `sm.node.delete` — must be non-null and not Deny


        The destination parent folder must already exist in the vault; moving a secret to a non-existent folder is not supported.

        '
      operationId: updateSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Current vault-relative path of the secret to update
        required: true
        schema:
          type: string
        example: /machine/DB
      - name: saveAsVersion
        in: query
        description: Archive the existing credential as a new version before applying the update
        required: false
        schema:
          type: boolean
          default: false
        example: 'true'
      - name: syncToTarget
        in: query
        description: Push the new credential to all mapped target accounts via the Broker
        required: false
        schema:
          type: boolean
          default: false
        example: 'false'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretDataDTO'
            examples:
              updateFieldValues:
                summary: Update secret field values (standard secret)
                value:
                  value:
                    url: https://new-app.example.com
                    username: admin
                    password: new-p@ssw0rd
              updateDualAccountSecondaryValues:
                summary: Update secondary credential values (dual-account secret only)
                value:
                  secondaryValue:
                    username: secondary-admin
                    password: secondary-p@ssw0rd
              moveSecret:
                summary: Move secret to a new folder
                value:
                  path: /new/destination/my-secret
        required: false
      responses:
        '204':
          description: No content
        '400':
          description: 'Bad request. Returned for the following violations:

            - `"Not allowed to rename and move secret simultaneously."` — the request body changed both `name` and `path` at the same time.

            - `"Invalid secret path : {path}"` — the destination path is malformed (missing leading `/`, contains `//`, ends with `/`, or the basename does not match the existing secret name).

            - `"Updating secret primary field values not allowed for dual account"` — `value` was provided in the request body for a dual-account secret; use `secondaryValue` instead.

            - `"Can not update secondary secret field values as dual account is not enabled"` — `secondaryValue` was provided but the secret does not have dual account enabled.

            - `SM-0178` — `rotationInterval` in hours is not a valid multiple of the vault''s `dynamicRotationIntervalHours` (when `rotationIntervalUnit` is `HOURS`).

            - `SM-0179` — Hourly rotation is not allowed when the vault''s `dynamicRotationIntervalHours` is `24`.

            - `SM-0180` — Hourly rotation interval is not allowed for static secrets.

            '
        '403':
          description: 'Forbidden. Returned when the caller does not have the required permissions on the destination folder.

            - `"Move not allowed due to missing permissions : {folder}"` — the caller is missing `sm.node.create` or `sm.node.delete` (or both) on the destination folder.

            '
  /api/v1/secretmanager/vault/{vaultId}/secrets/file:
    post:
      tags:
      - Secrets Manager
      summary: Create a secret file
      operationId: createSecretFileData
      parameters:
      - name: secretData
        in: query
        required: true
        schema:
          type: string
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret/Node parent path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update secret file
      operationId: updateSecretFileData
      parameters:
      - name: secretData
        in: query
        schema:
          type: string
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secrets/{secretId}/versions:
    get:
      tags:
      - Secrets Manager
      summary: List Secret Versions
      description: Lists all versions for a secret, ordered by version number (newest first).
      operationId: listSecretVersions
      parameters:
      - name: vaultId
        in: path
        description: Vault identifier
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: secretId
        in: path
        description: Secret identifier
        required: true
        schema:
          type: string
        example: secret-123
      - name: size
        in: query
        description: Page size for pagination
        required: false
        schema:
          type: integer
          format: int32
          default: 10
        exa

# --- truncated at 32 KB (47 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/britive/refs/heads/main/openapi/britive-secrets-manager-api-openapi.yml